AWS Network Traffic Lab
Interactive packet simulator
16px
VPC · SUBNETS · SECURITY GROUPS · ROUTE TABLES · ALB · EKS

Change one setting.
Watch the packet die.

Most AWS networking is learned by breaking something at 2am. This page lets you break it on purpose — flip a security group rule, delete a route, move a NAT gateway — and watch exactly where traffic stops and what error you'd see.

01 — SIMULATOR

Traffic flow lab

A three-tier VPC. Pick a request, press Send packet, and follow it hop by hop. Toggle any setting on the right and send it again — the diagram and the log both react.

PUBLIC INTERNET Browser 203.0.113.9 Engineer laptop Attacker 198.51.100.7 Amazon S3 AWS service Patch repo yum / apt VPC 10.0.0.0/16 Internet Gateway two-way door S3 Gateway Endpoint free · private PUBLIC SUBNET 10.0.1.0/24 · az-1a Application LB alb-sg :443 ← 0.0.0.0/0 NAT Gateway outbound only $0.045/hr + /GB Bastion host legacy · port 22 off by default PRIVATE APP SUBNET 10.0.10.0/24 · no public IP App server 1 10.0.10.5:8080 app-sg App server 2 10.0.10.6:8080 app-sg Target group 2 of 2 healthy check: /health PRIVATE DATA SUBNET 10.0.20.0/24 · no internet route RDS PostgreSQL 10.0.20.100:5432 db-sg ← app-sg Private hosted zone db.internal → .20.100 resolver 10.0.0.2 Private route table 10.0.0.0/16 → local 0.0.0.0/0 → nat-xxx
Hop-by-hop log packet trace
Press “Send packet” to trace a request.
Configuration
Flip a switch, then resend
The one rule

Put nothing in a public subnet except load balancers and NAT gateways. Every scenario on this page that ends badly starts by breaking that rule.

02 — DESIGN

Design your own VPC

The lab above runs a fixed topology. This one runs yours. Describe a VPC and everything inside it — subnets, route tables, gateways, security groups, instances — then send traffic through it and see which hop drops the packet. Every resource has an Enabled switch, so you can turn one thing off and watch what breaks. Designs are saved in your browser and export as a file.

Transfer
Add a resource
The reference other resources point at. Must be unique.
Enabled
Resources
NameTypeParentValues OnActions
Topology

Drawn from the table. Boxes light up as the packet moves through them.

Create a simulation

Pick a source and a destination from your own resources, then send a packet.

available once a packet has been sent
Potential issues
0

Static checks over the whole design — addressing, routing, exposure, redundancy. They re-run every time you change something.

The schema

Every design is a flat list of resources joined by name. Exported and imported files use JSON with exactly this shape; the YAML below is the same schema, annotated. Hand-write a file against it and the importer will take it.


  
03 — DIAGNOSTICS

Break it, then fix it

Ten failures that account for most real AWS networking tickets. Each one loads a broken config into the lab above. Read the symptom, guess the cause, then reveal the fix.

04 — KUBERNETES

EKS pod IP simulator

On EKS, every pod takes a real IP from your subnet. That's fast — and it's how clusters run out of addresses. Size a node group here and watch the ceiling move.

Prefix delegation
Assign /28 blocks, not single IPs
Custom networking
Pods on secondary CIDR 100.64.0.0/16
Pods per node
29
IPs needed
180
IPs available
251
Subnet utilisation72%

Pods get real VPC IPs

No overlay, no encapsulation. Flow Logs see pod traffic, ALBs target pods directly, security groups can apply per pod.

CoreDNS and ndots:5

Every external lookup fires 4 queries before succeeding. At scale this is a latency mystery that traces back to one line in resolv.conf.

One ALB, many Ingresses

Without group.name, 20 Ingresses build 20 load balancers at $16/mo each. With it, they share one.

05 — ADDRESSING

CIDR calculator

The slash number is how many bits are locked. Bigger slash, smaller block. Type a range and see exactly what it covers — including the five addresses AWS keeps for itself.

Overlap checker

Two VPCs that might ever connect must not overlap. Test a pair before you build.

A scheme that scales
10.0.0.0/16  prod · us-east-1
10.1.0.0/16  prod · eu-west-1
10.10.0.0/16 staging
10.20.0.0/16 dev
10.100.0.0/16 shared services
172.16.0.0/16 on-premises office
06 — FIREWALLS

Security group vs NACL

The difference that causes the most confusion: security groups remember the conversation, NACLs don't. Send a request through both and see where the reply gets stuck.

Stateful vs stateless

Allow inbound 443 on both. Then send a request and watch the return trip.

NACL outbound rule for ephemeral ports 1024–65535
NACL rule order

Rules run lowest number first and the first match wins. Drag the deny rule's number below 100 to make it actually work.

Security groupNetwork ACL
Attaches toA resource (ENI)A whole subnet
Rule typesAllow onlyAllow and Deny
StateStateful — replies auto-allowedStateless — both directions needed
EvaluationAll rules togetherNumber order, first match wins
Can reference other groupsYes — the killer featureNo, CIDR only
You need itAlwaysRarely — only for explicit denies
07 — BILLING

What the network costs

NAT Gateway is the line item that surprises people. Charges stack: hourly, plus per-GB processing, plus standard egress. Model your traffic and see what an S3 endpoint saves.

S3 gateway endpoint
Free. Always create it.
ECR + logs interface endpoints
~$7/mo per AZ each
Estimated monthly network cost
$0
Breakdown

us-east-1 list prices, mid-2026. Data transfer out to the internet is billed separately at ~$0.09/GB on top of NAT processing — so a byte leaving a private subnet is charged twice. Check the AWS Pricing Calculator before budgeting.

08 — REFERENCE

Concepts and official docs

Tap any card for the full explanation, a worked example, and a link to the AWS documentation.

09 — PRACTICE

Ship-it checklist

0 of 0